Appendix B: Manual Steps for Enabling Gmail Prevent (Inline) DLP Policy

If you receive the Manual Changes Required message while creating a Prevent (Inline) DLP policy for Gmail, you must make these changes in the Google Admin Console.

Step 1: Adding a Host

  1. Sign in to the Google Admin Console.

  2. From the left navigation panel, click Apps > Google Workspace > Gmail.

  3. Click Hosts.

  4. Click Add Route.

  5. Under Name, enter CLOUD-SEC-AV DLP Service.

  6. Under Specify email server, select Single host.

  7. Enter the host name as [portal identifier]-dlp.checkpointcloudsec.com.

    To find the portal identifier, see Portal Identifier of Harmony Email & Collaboration Tenant.

  8. Enter the port number as 25.

  9. Under Options, clear the Require CA signed certificate checkbox.

  10. Click Save.

Step 2: Updating Inbound Gateway

  1. From the left navigation panel, click Apps > Google Workspace > Gmail.

  2. Scroll down and click Spam, Phishing and Malware.

  3. Click Inbound gateway.

  4. Select Enable and under Gateway IPs, click Add and enter the IP address or IP address range relevant to your Infinity Portal tenant (account) region.

    For the list of supported IP addresses, see IP Addresses Supported Per Region.

  5. Click Save.

Step 3: Adding SMTP Relay Host

  1. From the left navigation panel, click Apps > Google Workspace > Gmail.

  2. Scroll-down and click Routing.

  3. Under SMTP relay service, click Add Another Rule.

  4. Enter a description for the rule.

  5. In the Allow Senders list, select Any Addresses checkbox.

  6. Under Authentication, do these:

    1. Select the Only accept mail from the specified IP addresses checkbox.

    2. Add all the IP addresses relevant to your Infinity Portal tenant (account) region.

      For the list of supported IP addresses, see IP Addresses Supported Per Region.

      To add an IP address:

      1. Click Add.

      2. Enter a Description for the IP address.

      3. Enter the IP address.

      4. Select the Enable checkbox.

      5. Click Save.

    3. Clear the Require SMTP Authentication checkbox.

  7. Under Encryption, select the Require TLS encryption checkbox.

  8. Click Save.

Step 4: Add Groups

You must create two groups.

  • check_point_inline_outgoing_policy

  • check_point_monitor_outgoing_policy

Note - If you use GCDS (Google Cloud Directory Sync) to synchronize your user groups on-premises and in the cloud, the synchronization triggers the deletion of these Check Point groups. Though this will not impact the email delivery, Harmony Email & Collaboration cannot scan the emails, and no security events get generated.

Before activating Google Workspace, you must create exclusion rules for these user groups. Select the exclusion type as Group Email Address, match type as Exact Match, and the group email address should be in the groupname@[domain] format.

For example, the group email addresses should be check_point_inline_outgoing_policy@mycompany.com and check_point_monitor_outgoing_policy@mycompany.com, where mycompany is the name of your company.

To create a group:

  1. From the left navigation panel, click Directory > Groups.

  2. Click Create Group.

  3. In Group name field, enter the group name. For example, check_point_inline_outgoing_policy.

  4. In Group email field, enter the group email. For example, check_point_inline_outgoing_policy.

  5. Click Next.

  6. In Access Settings, clear everything except the default settings.

  7. In Who can join the group, select Anyone in the organization can join.

  8. Click Create Group.

  9. Repeat the same procedure and create a group with Group name and Group email as check_point_monitor_outgoing_policy.

After creating the groups, you must do these to the check_point_monitor_outgoing_policy group.

  1. From the left navigation panel, click Directory > Groups.

  2. Hover over the check_point_monitor_outgoing_policy group you created and click Add members.

  3. Click Advanced and select the Add all current and future users of {domain} to this group with All Email setting checkbox.

  4. Click Add to Group.

Step 5: Create a Compliance Rule

  1. From the left navigation panel, click Apps > Google Workspace > Gmail.

  2. Scroll-down and click Compliance.

    By default, the system shows these rules in Content compliance:

    • [portal identifier]_monitor_ei

    • [portal identifier]_monitor_ii

    • [portal identifier]_monitor_eo

    • [portal identifier]_inline_ei

    To find the portal identifier, see Portal Identifier of Harmony Email & Collaboration Tenant.

  3. Update the settings for [portal identifier]_monitor_eo rule.

    1. For [portal identifier]_monitor_eo rule, click Edit.

    2. Scroll-down to the end of the Edit setting pop-up and click Show options.

    3. Under Envelope filter, select the Only affect specific envelope senders checkbox.

    4. From the list, select Group membership (only sent mail).

    5. Click Select groups and select check_point_monitor_outgoing_policy.

    6. Click Save.

  4. Create the [portal identifier]_inline_eo rule with these settings:

    1. From the Content compliance rules, click Add Another Rule.

    2. Enter the Content compliance rule name as [portal identifier]_inline_eo.

      To find the portal identifier, see Portal Identifier of Harmony Email & Collaboration Tenant.

    3. Under Email messages to affect, do these:

      1. Select Outbound checkbox.

      2. In Add expressions that describe the content you want to search for in each message, select If ALL of the following match the message.

      3. Click Add.

      4. In the Add setting pop-up, select Metadata match.

      5. Under Attribute, select Source IP.

      6. Under Match type, select Source IP is not within the following range.

      7. Enter all the IP addresses relevant to your data region.

        For the list of supported IP addresses, see IP Addresses Supported Per Region.

      8. Click Save.

    4. Under If the above expressions match, do the following, do these:

      1. Select Modify message.

      2. Under Headers, do these:

        1. Select Add X-Gm-Original-To header checkbox.

        2. Select Add X-Gm-Spam and X-Gm-Phishy headers checkbox.

        3. Select Add custom headers checkbox and add custom headers with these values.

          Header Key

          Header Value

          CLOUD-SEC-AV-Sent

          true

          CLOUD-SEC-AV-Info

          [portal],google_mail,sent,inline

          To add a custom header:

          1. Click Add.

          2. In Header key, enter the header key.

          3. In Header value, enter the header value.

          4. Click Save.

      3. Under Route, do these:

        1. Select the Change route checkbox.

        2. Select the Also reroute spam checkbox.

        3. In the list, select CLOUD-SEC-AV DLP Service.

    5. Scroll-down to the end of the page and click Show options.

    6. Under Account types to affect, select Users and Groups checkbox.

    7. Under Envelope filter, do these:

      1. Select the Only affect specific envelope senders checkbox.

      2. From the list, select Group membership (only sent mail).

      3. Click Select groups and select check_point_inline_outgoing_policy.

      4. Click Save.

IP Addresses Supported Per Region

    • 35.174.145.124

    • 3.214.204.181

    • 44.211.178.96/28

    • 44.211.178.112/28

    • 3.101.216.128/28

    • 3.101.216.144/28

    • 13.211.69.231

    • 3.105.224.60

    • 3.27.51.160/28

    • 3.27.51.176/28

    • 18.143.136.64/28

    • 18.143.136.80/28

    • 15.222.110.90

    • 52.60.189.48

    • 3.99.253.64/28

    • 3.99.253.80/28

    • 3.101.216.128/28

    • 3.101.216.144/28

    • 52.212.19.177

    • 52.17.62.50

    • 3.252.108.160/28

    • 3.252.108.176/28

    • 13.39.103.0/28

    • 13.39.103.23/28

    • 3.109.187.96

    • 43.204.62.184

    • 43.205.150.240/29

    • 43.205.150.248/29

    • 18.143.136.64/28

    • 18.143.136.80/28

    • 3.29.194.128/28

    • 3.29.194.144/28

    • 13.42.61.32

    • 13.42.61.47

    • 13.42.61.32/28

    • 13.42.61.47/28

    • 13.39.103.0/28

    • 13.39.103.23/28